Guests
macOS, Linux and Windows 11
Real VMs on Apple’s Virtualization framework, in a window or quietly in the background.
A local sandbox for AI agents
Let your agents loose. On a machine that isn’t yours.
Hangar gives Claude Code, Codex or any agent its own macOS, Linux or Windows VM, right on your Mac. It can install and run anything, and reach only the hosts you allow, with every connection watched from outside the guest.
- Runs on your Mac
- macOS 27 or later
- Apple silicon
~ — zsh
$ hangar create agent --os macos --image base
$ hangar policy agent --mode allowlist \
--allow anthropic.com --allow github.com
$ hangar snapshot take agent clean
$ hangar run agent --background
$ ssh admin@$(hangar ip agent --wait 60)
# inside, let it rip: claude, approvals off
# worst case? restore the snapshot ☕
$
Agents work best with full permissions. Give them a sandbox, not your laptop.
Approving every command slows an agent to a crawl; skipping approvals on your own Mac is a bet with your files and keys. In a Hangar VM the agent works unattended, and you decide what it can reach.
Run your first agent in a VMA real machine
Not a container: a VM with its own kernel, disk and network on Apple’s Virtualization framework. Root, sudo, Homebrew, servers, all fine.
Only the hosts it needs
Its model’s API, GitHub and npm, and nothing else. Start from a template for Claude Code or Codex.
PoliciesWatched from outside
Every lookup and connection is seen from the Mac, where software in the VM can’t hide from it.
Only its folder
Share one project folder, read-only if you like. The rest of your files stay out of the VM.
A way back
Snapshot before a run and restore after, and the VM is back exactly where it started.
As many as you like
Clone one clean snapshot into several agents, each with its own address and identity.
Traffic rules
Everything your agent talks to, in plain sight
Hangar watches from the Mac, so an agent can’t hide its traffic or switch the watching off: DNS lookups, host names from DNS, TLS and HTTP, bytes in and out, and what was blocked. Pick a mode and watch it land on a running VM.
Build a policy
agent — hangar traffic
$ hangar policy agent --mode monitor
$ hangar traffic agent --follow
02:39:42 allow tcp api.anthropic.com 160.79.104.10:443 ↑38 KB ↓12 KB
02:39:44 allow tcp github.com 140.82.121.3:443 ↑2 KB ↓570 KB
02:39:45 allow dns registry.npmjs.org A
02:39:47 allow tcp registry.npmjs.org 104.16.27.34:443 ↑1 KB ↓84 KB
02:39:48 allow tcp ads.example.com 203.0.113.7:443 ↑3 KB ↓12 KB
02:39:50 allow dns example.com A
~ — zsh
$ hangar snapshot take agent clean
$ hangar clone agent agent2 --snapshot clean
$ hangar clone agent agent3 --snapshot clean
$ hangar stop agent
$ hangar snapshot restore agent clean
Snapshots and images
Let it try. Roll it back.
Take a snapshot before the agent starts; when it’s done, stop the VM and restore it. Snapshots are copy-on-write, so they’re instant and only take space as the disk changes.
Snapshots and imagesSnapshots
Taken while a macOS VM runs, a snapshot keeps its memory too, so a restored VM picks up where it was.
Clones
Start several agents from one clean snapshot. Each clone gets its own MAC address, IP address and machine identity, while the source keeps running.
Images
Push a macOS, Linux or Windows VM to any OCI registry, or save it as a .tar file, and create VMs from it anywhere.
Images and registries
Share CI environments with your team. Privately.
Push a macOS, Linux or Windows VM, or one of its snapshots, to the container registry you already use. Hangar’s images are OCI images, so your registry takes them as they are: no new service to run, nothing extra to set up. Everyone creates the same VM from its tag.
- It stays in your registry, behind your team’s sign-in. The token goes to your Keychain.
- Every part is checked against the image’s digest, and downloads carry on where they stopped.
- No registry at hand? Save it as a .tar file and pass that around instead.
- GitHub
- GitLab
- Docker Hub
- Harbor
- Quay
~ — zsh
$ hangar login ghcr.io -u acme-ci
$ hangar export ci ghcr.io/acme/ci-linux:1.0 --snapshot clean
# on a teammate’s Mac, or a build server:
$ hangar create ci1 --os linux --image ghcr.io/acme/ci-linux:1.0
One small app. Every guest you need.
Images
Ready in one step
Hangar’s macOS images, Debian and Ubuntu cloud images, or your team’s own from a registry.
Snapshots
Instant, and cheap
Copy-on-write snapshots and clones that only take space as the disk changes.
Guest agent
It knows the guest
The guest’s real memory use, a shared clipboard, and Homebrew ready in macOS.
Files
Drop it in
Shared folders, and files dragged onto a VM’s window land where you let go.
CLI
An app and a command line
Click around in the app or script it in the terminal. Both work on the same VMs.
Policies
Rules for the agents you run. Or your own.
Claude Code
The API and sign-in, GitHub for plugins, npm for MCP servers. The optional Datadog telemetry hosts stay off.
Claude · GitHub · npm
Use this
Codex
OpenAI’s API and ChatGPT sign-in, with GitHub and npm to work with.
OpenAI · GitHub · npm
Use thisCI runner
Check out from GitHub, install from npm, PyPI, crates.io and Go, pull from Docker Hub.
GitHub · npm · PyPI · Rust · Go · Docker Hub
Use thisYour first VM. About a minute from now.
01
Download
Drag Hangar into Applications. For the command line, choose Settings › Command Line › Install…
02
Pick macOS or Linux
On the welcome screen, or after ⌘N. Quick Start picks the Base image or Debian 13 for you.
03
Create and Start
The VM opens when it’s ready, with the user admin, the password admin and SSH on. Change the password.
License
Free for you. Fair for teams.
Hangar is free on any Mac used by one person. A company can also run it on shared machines and build servers with up to 100 CPU cores in total; more than that needs a separate license from Baseguard.